Tunnel monitoring in Palo Alto Firewall node - Need filter for receiving alerts for the Tunnel instead of all the proxies within it.

Hi, we have enabled monitoring IPSec tunnels for the Palo Alto. I would like to know if there is a way or specific filter that can be applied to receive alerts only when the tunnel is down or up, because we are getting alerts even when the proxies for the tunnel are down or up and since, we have multiple tunnels each with multiple proxies, we are receiving more than 100 alerts for this node alone, specifically for the proxies up/down status.

Find more posts tagged with

palo

npm

solarwinds certified professional

Accepted answers

All comments

cheryl1

First are you seeing that information in any web console displays like Node Details or Network Insight for Palo Alto? We would need to be polling the specific entity and status in order to alert on it. If you haven't enabled Network Insight for Palo Alto, the information you want might be in that feature. Here is an article on how to enable the feature. It is an NPM-specific article, but the process is identical in NPM and Hybrid Cloud Observability. https://documentation.solarwinds.com/en/success_center/npm/content/npm-monitor-palo-alto-firewalls.htm There is more specific tunnel monitoring in Network Insight, amongst other things.

If the information you want is not polled either by standard polling or by Network Insight, then you may need to identify IF SNMP polls that specific metric and build a custom poller. If you need an API to poll it, you can use the API poller tool in the Platform.

Once you poll the metric you need, you'll have to build a custom alert. Depending on the field selection for the trigger conditions, you might be able to build it using the interactive wizard, but you might have to build it with custom SWQL. Hard to say at this point until we see how the metric is reported.

I hope that helps!

yogesh_m

To answer your question, yes, I have already enabled polling for Palo Alto in that node.

I would like to know the customization that I can have to recieve alerts for the IPSec Tunnel itself and not the proxies within it, which I find difficult because NPM identifies each proxy tunnels as seperate tunnel and no monitoring I see for the actual IPSec tunnel.

cheryl1

OK, if you're not getting the additional information you need from the default polling, either standard or with Network Insight, then you'll likely have to build a custom SNMP poller for the metric if it is surfaced through SNMP. We also have a REST API polling tool if needed. But once you can poll the specific metric, you can alert on it.